SecuritySuite - SuiteCRM and CE Teams

Hello, I was trying to create a two security groups and limit the access to the certain module for the second one but allow on the first one. The problem is they were suppose to share let's say Leads without restrictions but one should not be accessing Notes and the other should? How can I accomplish this using Security Suite rules? I have tried all that I could think of including not inheritable option, setting primary group. It seems that when you add second group regardless of what were the settings of the first group, the rules in Roles of the first group are precede by that second group. If we can set that Deny always precede Allow rule regardless of how many groups one user is a member of, that could be great for accomplishing this scenario. Looking forward to your reply. Best Regards, Slaven.